CVE-2026-34722 MEDIUM

CVE-2026-34722: Zammad is missing authorization in ticket create endpoint

Vendor Zammad
Product zammad
Weakness CWE-862 · Missing authorization
Published April 8, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.

Key dates

02Disclosure timeline

April 8, 2026 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-64249 WordPress Protect WP Admin plugin <= 4.1 - Broken Access Control vulnerability CVE-2025-69348 WordPress The Events Calendar Countdown Addon plugin <= 1.4.15 - Broken Access Control vulnerability CVE-2024-1337 SKT Page Builder <= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injection CVE-2023-51515 WordPress Uncode Core plugin <= 2.8.8 - Privilege Escalation vulnerability CVE-2026-3155 OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'